CVE-2024-52333: Offis DCMTK Buffer Overflow Vulnerability

CVE-2024-52333 Overview

CVE-2024-52333 is an out-of-bounds write vulnerability in the determineMinMax functionality of OFFIS DCMTK 3.6.8. DCMTK is a widely deployed open-source toolkit for handling Digital Imaging and Communications in Medicine (DICOM) files in medical imaging environments. A specially crafted DICOM file triggers improper array index validation, allowing an attacker to write outside allocated memory bounds. Successful exploitation requires the victim to open or process a malicious DICOM file locally. The flaw is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
Processing a malicious DICOM file leads to an out-of-bounds write that can corrupt memory and enable arbitrary code execution in the context of the DCMTK process.

Affected Products

OFFIS DCMTK 3.6.8
Debian LTS distributions packaging DCMTK 3.6.8
Downstream medical imaging tools embedding DCMTK 3.6.8 libraries

Discovery Timeline

2025-01-13 - CVE-2024-52333 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52333

Vulnerability Analysis

The vulnerability resides in the determineMinMax function within DCMTK 3.6.8, which processes pixel data attributes from DICOM files. The function fails to validate array indices before performing write operations on internal buffers. When a DICOM file supplies crafted metadata or pixel structure values, the resulting index computation exceeds the allocated buffer size. The subsequent write corrupts adjacent memory. Attackers can shape the corrupted memory to hijack control flow. DICOM parsing tools frequently run with the privileges of the user processing imaging studies, which in clinical workstations may include radiologists or PACS integration services. Because DCMTK is embedded in numerous downstream products, the vulnerability surface extends beyond the reference implementation.

Root Cause

The root cause is improper array index validation inside determineMinMax. The function trusts values derived from attacker-influenced DICOM attributes without enforcing upper-bound checks against the destination buffer. This mismatch between declared and actual bounds produces the out-of-bounds write documented in [CWE-119].

Attack Vector

Exploitation requires local access and user interaction. An attacker delivers a malicious DICOM file through email, removable media, a PACS ingestion pipeline, or a shared file store. When a user or automated process parses the file with a DCMTK-based tool, the out-of-bounds write triggers. The vulnerability does not require authentication to the target process.

No public proof-of-concept or verified exploit code is available. Refer to the Talos Intelligence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-52333

Indicators of Compromise

Unexpected crashes or segmentation faults in DCMTK utilities such as dcmdump, dcmj2pnm, or img2dcm when processing incoming DICOM files.
DICOM files originating from untrusted sources with malformed pixel data attributes or anomalous Value Representation (VR) fields.
Child processes spawned by DICOM parsing utilities that deviate from normal imaging workflows.

Detection Strategies

Inspect DICOM ingestion pipelines for parser crashes and correlate them with the source and hash of the offending file.
Deploy behavioral monitoring on medical imaging workstations to flag memory corruption signatures and abnormal control flow in DCMTK binaries.
Enforce file content validation at PACS and modality gateways to reject DICOM files with inconsistent header metadata.

Monitoring Recommendations

Log all invocations of DCMTK command-line utilities along with input file paths and originating users.
Alert on DCMTK processes producing core dumps or exiting with signals indicative of memory corruption.
Track DICOM files transferred over DIMSE or DICOMweb protocols from external partners for later forensic review.

How to Mitigate CVE-2024-52333

Immediate Actions Required

Upgrade DCMTK from 3.6.8 to the fixed upstream version incorporating commit 03e851b0586d05057c3268988e180ffb426b2e03.
Apply distribution updates such as the Debian LTS Announcement for packaged DCMTK builds.
Restrict DICOM file ingestion from untrusted senders until patched versions are deployed.

Patch Information

OFFIS released a fix referenced in the DCMTK Commit Update. Downstream packagers, including Debian LTS, have shipped updated builds. Vendors embedding DCMTK libraries in imaging products should rebuild against the patched sources and re-issue affected components.

Workarounds

Process DICOM files from untrusted origins inside sandboxed or containerized environments with no network egress.
Run DCMTK utilities under least-privilege service accounts to limit the impact of memory corruption.
Add pre-parsing validation gateways that enforce strict DICOM conformance before files reach DCMTK.

bash

# Example: pin DCMTK to a patched build on Debian-based systems
sudo apt-get update
sudo apt-get install --only-upgrade dcmtk libdcmtk-dev
dcmdump --version